> Optional: verify public key on Keybase.

For organizations publishing employee keys via Web Key Directory can also be an additional signal that the key is trustworthy.

It's also quite simple: for example exporting the key 5C090ED7318B6C1E (binary, not armored) and putting it on this exact URL: https://datadoghq.com/.well-known/openpgpkey/hu/964aj6q73iat... is enough to discover the key using e-mail address.

This post goes into more detail: https://spacekookie.de/blog/usable-gpg-with-wkd/

WKD is used by Linux distros (ArchLinux, Gentoo, Debian...) and kernel.org itself: https://www.kernel.org/category/signatures.html#using-the-we... as well as some OpenPGP sites (e.g. ProtonMail).